DEV Community: Johan Sydseter

We are happy to announce the release of the OWASP Cornucopia Mobile App Edition v2.0. The latest edition is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, and features 80 threats that cover all the requirements, tests, and weaknesses of OWASP.

Johan Sydseter — Thu, 10 Sep 2026 06:54:46 +0000

Johan Sydseter for OWASP® Foundation

Sep 10

OWASP Cornucopia Mobile App Edition v2.0

#cybersecurity #mobile #security #software

8 min read

OWASP Cornucopia Mobile App Edition v2.0

Johan Sydseter — Thu, 10 Sep 2026 06:53:07 +0000

We are happy to announce the release of the OWASP Cornucopia Mobile App Edition v2.0. The latest edition is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, and features 80 threats that cover all the requirements, tests, and weaknesses of the OWASP Mobile Application Security Project.

Why would you use OWASP Cornucopia Mobile App Edition?

At Admincontrol, the OWASP Cornucopia Mobile App Edition is used to implement mobile application security by design. Before building mobile apps and features, OWASP Cornucopia helps the team identify threats during the threat modeling and design phase. For example, during gameplay, a developer identifies that card AA3 should be considered during app development. Each identified card includes a mapping table showing which CAPEC™s, OWASP MASWEs, MASTG Best Practices, MASTG Knowledge base, MASTG tests, and MASVS requirements apply when developing a specific mobile feature. This simplifies identifying mobile application security requirements during development and makes it possible to decide on security requirements during the development sprint in an agile, lean way.

During gamification and threat modeling, the team identifies threats that naturally drive application security requirements. Doing this before sprint planning makes threat modeling and security requirement analysis part of the team's SDLC. In addition, it’s the team that gets to decide «what can go wrong» and «what we are going to do about it». Letting the team decide ensures alignment with the application security requirements and security goals and prevents scope creep and dissatisfied scrum masters. Security awareness and a security sprint scope are created as a result. Doing games and threat modeling before sprint planning builds engagement, alignment, and security awareness without pushback that could push security issues to the backlog and let them be forgotten.

Why should I do this when I can use AI agents?

There is this quote from David Dunning where he says: "If you're incompetent, you can't know you're incompetent. The skills you need to produce a right answer are exactly the skills you need to recognize what a right answer is."

«Fighting The Passive Learning Trap», Psychology Today

What do I mean by that? Well, let's say your AI agents have created a beautiful threat model and secure design for your application that requires you to implement «Just-In-Time Access», but then, during the development sprint, it clashes with one of the features that the product owner has been told to implement by the product manager. When asking your Claude-based AI agents to fix it, it takes an extraordinary amount of time and becomes really expensive. After it has finished, the AI agents' review comes back with 200 comments. The work never seems to finish, and the AI review agent, the AI threat modeling agent, and the AI Coding agent don’t seem to agree with each other. In the end, after a lengthy discussion with Claude, you understand that implementing Just-In-Time access is a much more extensive task than what you initially thought it was. After all, you didn’t have a clue about it in the first place. So what do you do? The product manager doesn’t give in; he wants his feature. Maybe Just-In-Time access isn’t that important after all?
The feature ships, but the security remains underdeveloped. That is, until AI agents from North Korea come knocking.

There are no shortcuts to learning. You need to know what is important and how to make the right decisions.
AI agents can’t make the decisions for you. AI agents are sycophants. They will happily cheer you on even if you make the wrong choices. This is why we do threat modeling. Through the threat modeling process, the whole team learns «what can go wrong» and «what we are going to do about it». Offshoring your decision-making processes is a terrible risk management strategy that will lead your life to ruin.

Mobile App Edition v2.0

The latest edition is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, and features 80 threats that cover all the requirements, tests, and weaknesses of the OWASP Mobile Application Security Project.
The deck has six suits of 13 cards plus two jokers, with the suit names taken from MASVS:

Platform & Code (PC)
Authentication & Authorization (AA)
Network & Storage (NS)
Resilience (RS)
Cryptography (CRM)
Cornucopia (CM), which contains threats related to MASVS Privacy requirements, and where we have also added some nasty cards related to mobile malware.

The edition exists in English and has been translated into Hindi, Russian, and Ukrainian.
To play the game online, visit cornucopia.owasp.org and click on «Play online».

AI mobile development

With the new edition, you can also combine it with the OWASP Cornucopia Companion Edition. The new OWASP Cornucopia Companion Edition complements the existing two editions. The OWASP Cornucopia Companion Edition v1.0 comes with 6 companion suits covering new topics:

Agentic AI (AAI)
Automated Threats (BOT)
Cloud (CLD)
Frontend (FRE)
Large Language Models (LLM)
DevOps (DVO)

A suit in the companion deck may replace (or be used in addition to) suits in the existing Mobile App Edition so that players can add a specific focus to their threat modeling. Let’s say you are building an LLM mobile application and want to perform threat modeling and security requirement analysis specifically for Mobile and LLM. You would then use the OWASP Cornucopia Mobile App Edition and the LLM companion suite as your elected OWASP Cornucopia focus area.

If you want to buy a physical version of the Companion Edition, go to CyberSec Games where you can buy the 25th Anniversary Edition as it also comes with both the Website App Edition 3.0 and the new OWASP Cornucopia Companion Edition. The Mobile App Edition v2.0 is available for pre-order at: https://cybersecgames.com/products/owasp-cornucopia-mobile-app-edition-threat-modeling-cards.

AI Threat Modeling with PHANTOM-B

As the application security landscape shifts, Large Language Models (LLMs) and Agentic AI introduce entirely new threat vectors. To help you tackle these, the Cornucopia Companion suits for Large Language Models and Agentic AI have been upgraded.

We have added PHANTOM-B mapping to each of these cards. If you check the help pages for the LLM and Agentic AI cards, you will now find detailed explanations for these mappings to help your team get familiar with AI Threat Modeling natively in your sessions.

What is PHANTOM-B?

If you haven't read Adam Shostack's recent post on Why PHANTOM-B?, PHANTOM-B is a tool designed to structure how you answer the question: "What can go wrong?» (with the LLM parts of the system).

Created by Adam Shostack and the Shostack + Associates team—and validated alongside hyperscalers and global financial institutions—it's a STRIDE-analogous mnemonic engineered specifically for LLMs. While vulnerability lists like the OWASP LLM Top 10 are fantastic for general awareness, they don't explicitly tell you how your specific architecture will fail.

PHANTOM-B is a repeatable, lightweight threat elicitation tool that focuses strictly on what engineering teams can control and influence, scaling complex generative AI behaviors into an actionable map.

Cornucopia, now 100% synced with AISVS v1.0

In case you missed it, AISVS - OWASP Artificial Intelligence Security Verification Standard was recently released as version 1.0, and we have made sure OWASP Cornucopia is correctly mapped to AISVS. This way, after you have figured out what can go wrong with LLMs and agentic systems during the threat modeling sessions, we can help you answer the question: «What are we going to do about it?»

How to get those requirements into your issue tracking software

So you have done your threat modeling and security requirements analysis; what comes next? You need to create an issue the development team can work on, and add it to the development team's sprint. How do you do it?
The OWASP Cornucopia project is creating a requirements API that lets you harvest the security requirements you want. After you have created your threat model in OWASP Threat Dragon, extract its JSON response, look up the threats you have identified, and find the corresponding security requirements by using the API, merge the results together, and generate your evil user stories by pushing the results to your issue tracking software just in time for the development team's next sprint.

OWASP Cornucopia is looking for sponsors

Calling all AppSec heroes, card sharks, and generous sponsors! 🃏

By now, you probably think: «How can someone be crazy enough to do all this work for free?»
You are right; it’s absolutely crazy. Just think about it. All this card design and security requirement mapping work is done manually without the use of AI. We have fitted all OWASP ASVS, MASVS, AISVS, MASTG, DSOMM, SAMM, Web/Agentic/LLM Top 10, CAPECs, Mitre Atlas, etc., etc. (look here for not even a full list) onto 240 playing cards divided on 3 decks that can be played both physically and digitally. It’s crazy, absolutely unique, lots of fun, and a practical solution that helps teams bake secure coding into everyday conversations. It turns threat modeling into something people actually want to do. Yes, really.
But here’s the twist…
The project is currently missing a sponsor.
That means there’s a golden opportunity for a forward-thinking company to:

-> Support an open, globally recognized OWASP project
-> Help make secure development more accessible (and enjoyable!)
-> Get your logo featured directly on the Cornucopia decks used by teams worldwide

Imagine your brand on desks during threat modeling sessions, workshops, and security training worldwide.
Not a bad place to be, right?

Whether you're a security vendor, consultancy, or just passionate about improving software security—this is a chance to give back to the community and gain visibility where it matters.
If that sounds interesting, now’s the perfect time to step in and deal yourself a winning hand.

Know a company that should jump on this? Tag them below
Curious about sponsoring? Let’s get the conversation going

Learn more at: https://cornucopia.owasp.org/news/20260525-become-a-cornucopia-sponsor

Final words

OWASP Cornucopia welcomes any input or improvements you're willing to share. For anyone wanting to share their opinion, please don't hesitate to visit our repository, share your feedback, and, if appropriate, give us a star⭐️.

OWASP is a non-profit foundation that envisions a world with no more insecure software. Our mission is to be the global open community that powers secure software through education, tools, and collaboration. We maintain hundreds of open-source projects, run industry-leading educational and training conferences, and meet through over 340 chapters worldwide.

We’re thrilled to bring you OWASP Cornucopia v3.4 with an update that expands how we identify threats, whether you're mapping out traditional web applications or diving headfirst into the latest AI architectures.

Johan Sydseter — Tue, 21 Jul 2026 08:16:37 +0000

Johan Sydseter for OWASP® Foundation

Jul 21

OWASP Cornucopia v3 with EoP and PHANTOM-B

#ai #gamedev #security #cornucopia

6 min read

OWASP Cornucopia v3 with EoP and PHANTOM-B

Johan Sydseter — Tue, 21 Jul 2026 08:15:57 +0000

We’re thrilled to bring you OWASP Cornucopia v3.4 with an update that expands how we identify threats, whether you're mapping out traditional applications or diving headfirst into the latest AI architectures.

Elevation of Privilege (EoP)

One of the exciting updates in this release is the addition of the Elevation of Privilege (EoP) deck to the Cornucopia Help Pages. The new help pages are directly linked from our online game engine Copi when you play EoP at copi.owasp.org

We Need Your Help!

While the game is live, we are actively looking for community contributors to help us with the help pages for each of the EoP cards. Specifically, we need security minds to help players better answer:

What can go wrong?
What are we going to do about it?

If you have experience with EoP or want to flex your threat mitigation muscles, we would love your pull requests to help guide players!

Why are we doing this? Well, first off, it is to give players the option to visit the EoP help pages while they are playing EoP at copi.owasp.org!

When playing EoP at copi.owasp.org, you will now be able to click the «Need more info» links on each card, which will take you to the help pages, and we are looking for your expertise to fill them out.

Thanking Our GSoC Contributors

I want to take a moment to extend a massive thank you to our Google Summer of Code (GSoC) student, Ayman Algamal. Ayman has taken on adding the EoP game to our card browser for OWASP Cornucopia. At a high level, this project aims to solve the current roadblock where OWASP Threat Dragon lacks the ability to integrate EoP into their EoP games threat modelling diagrams. By adding a fully browsable EoP deck and exposing the cards through the existing API, Ayman's work will cleanly unblock this integration. We hope this will help development teams to more easily use EoP during their threat modelling sessions. Read more about how further down!

AI Threat Modelling with PHANTOM-B

As we look at the shifting landscape of application security, Large Language Models (LLMs) and Agentic AI are introducing entirely new threat vectors. To help you tackle these, the Cornucopia Companion suits for Large Language Models and Agentic AI have been upgraded.

We have officially added PHANTOM-B mapping to each of these cards. If you check the help pages for the LLM and Agentic AI cards, you will now find detailed explanations for these mappings to help your team get familiar with AI Threat Modelling natively in your sessions.

What is PHANTOM-B?

If you haven't read Adam Shostack's recent post on Why PHANTOM-B?, PHANTOM-B is a tool designed to structure how you answer the question: "What can go wrong?» (with the LLM parts of the system).

Created by Adam Shostack and the Shostack + Associates team—and validated alongside hyperscalers and global financial institutions—it serves as a STRIDE-analogous mnemonic specifically engineered for LLMs. While vulnerability lists like the OWASP LLM Top 10 are fantastic for general awareness, they don't explicitly tell you how your specific architecture will fail.

PHANTOM-B provides a repeatable, lightweight threat elicitation tool that focuses strictly on what engineering teams can actually control and influence, scaling down complex generative AI behaviours into an actionable map.

Seats are filling up fast for Shostack + Associates Threat Modelling Intensive with Complete AI at this year’s Black Hat conference. If you are interested in knowing more about AI Threat Modelling and are in the vicinity, you should not forget to sign up.

Registrations for their course is apparently still open! https://blackhat.com/us-26/training/schedule/index.html#adam-shostacks-threat-modeling-intensive-with-complete-ai-51473?trk=public_post_comment-text

Cornucopia, now 100% synced with AISVS v1.0

In case you missed it, AISVS - OWASP Artificial Intelligence Security Verification Standard was recently released as version 1.0, and we have made sure OWASP Cornucopia is correctly mapped to AISVS This, so that after you have figured out what can go wrong with LLM and Agentic during the threat modeling sessions, we can help you answer the question: «What are we going to do about it?»

A special thanks to Mayur Agnihotri for adding AISVS v1 “High-Impact Action Approval and Irreversibility Controls” to the Agentic AI cards and to Adarsh Kumar for continuing pushing out bug fixes. You both rock!

Smarter, Smoother Game Sessions

Finally, we know that scheduling a full threat modelling session with your entire team isn't always easy, and sometimes network connections and web browsers fail.

To improve the player experience, we have upgraded game sessions by saving the session state server-side. In addition to stability, we have introduced the concept of sharing your card hand. If you run out of time or have an emergency, you can simply hand off your cards so another team member can seamlessly take over your spot.

We can’t wait for you to try out 3.4.0. Grab your team, deal your hands, and let’s make threat modelling fun again!

Threat Dragon and EoP Games

When choosing a tool for publishing our threat model, we chose OWASP Threat Dragon. OWASP Threat Dragon is a free, open-source, cross-platform threat modelling application. It is used to create threat modelling diagrams and list threats for elements within the diagrams. Mike Goodwin created Threat Dragon as an open-source community project that provides an intuitive, accessible way to model threats.

OWASP Threat Dragon recently released this possibility in v2.6. This was just the start of integration between the two projects. In v2.7 of OWASP Threat Dragon, we will make both the OWASP Cornucopia Companion Edition and Elevation of Privilege available from Threat Dragon!

It's now possible to create your OWASP Cornucopia Threat Model directly in OWASP Threat Dragon. When creating a new diagram for your threat model, simply choose to create an EoP Games diagram. We chose to call the diagram EoP Games for two reasons. One, OWASP Cornucopia is derived from the Elevation of Privilege game created by Adam Shostack. Second, we don't want to stop with OWASP Cornucopia. We also want to add other EoP games, such as the original Elevation of Privilege game.

Once you have created an EoP Games diagram, you can add OWASP Cornucopia threats to your threat model. The specific threat you add will get a link reference to the OWASP Cornucopia website, where you will find guidance on threat modelling and STRIDE, which will help you in identifying what can go wrong and what to do about it. You can also find a complete mapping to OWASP ASVS, OWASP Developer Guide, and all relevant CAPECs.

Final words

OWASP Cornucopia welcomes any input or improvements you might be willing to share with us. For anyone wanting to share their opinion, please don't hesitate to visit our repository, share your feedback, and, if appropriate, give us a star⭐️.

OWASP is a non-profit foundation that envisions a world with no more insecure software. Our mission is to be the global open community that powers secure software through education, tools, and collaboration. We maintain hundreds of open source projects, run industry-leading educational and training conferences, and meet through over 340 chapters worldwide.

DBD Cornucopia is now available to play online!

Johan Sydseter — Wed, 17 Jun 2026 12:22:44 +0000

In development, we are used to understanding threat modelling as a structured method to make applications and other software secure. And in this, “secure” usually means to protect against adverse events and their associated harms as they impact the system (e.g. to maintain availability), its data (e.g. to protect its confidentiality) and the organisation more widely (e.g. to ensure continued operation). OWASP Cornucopia's three editions (Website App, Mobile App and Companion) all help threat modelling from this perspective.

But assessments of threats can also use different perspectives. Developers may come across privacy impact assessments (PIAs), where threats to users' data and the impact on those users are paramount. PIAs may additionally examine harms to organisations, third parties and wider society.

Negative impacts on benefit claimants

In recent years, Colin Watson, who created OWASP Cornucopia in 2012, undertook a PhD at Newcastle University, UK. This examined how the digital implementation of e-government services impacts citizens. The research's scope was digitisation of social protection cash payments (in the UK called “welfare benefits”) and those working-age citizens who apply for, and possibly receive, the support payments (in the UK known as “benefit claimants”). The PhD used case studies of Universal Credit (UC), which is an income-related minimum resource payment, and, to a lesser extent, of Personal Independence Payment (PIP), an invalidity-related social protection payment. The research identified how many requirements for digitised services are not defined in government legislation or regulation, leading to what can be somewhat arbitrary “digital discretion” during design, implementation and operation. And many of these decisions can have negative impacts on benefit claimants. Following completion of the PhD, Colin Watson gathered together all the harms identified that can arise through the choices made during the software development lifecycle. These are far broader and deeper than the few commonly referred to accessibility matters (which can sometimes also be constrained to concerns about the UI).

“Digital Benefits and Disbenefits (DBD Cornucopia)”

These harms have now also been converted into a Cornucopia-style deck of cards, to help teams identify negative impacts on the service users, and thus to provide requirements which avoid or minimise such harms. The deck is called “Digital Benefits and Disbenefits Cornucopia” (DBD Cornucopia) and uses the same game method.

The Card Deck

Whilst the deck's threat descriptions, harm explanations and examples on the website reference use UK-specific language like “welfare benefit” instead of “social protection payment”, and “claimants” instead of “service users” or “citizens”, the threats are easily understandable for other jurisdictions, and other types of e-government services. Like OWASP Cornucopia, DBD Cornucopia is open source and free to use. It is licensed under the Creative Commons Attribution-ShareAlike 3.0 licence, so you can copy, distribute and transmit the work, and you can adapt it and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar licence to this one. Make your own version!

The Online Cornucopia Game Engine - Copi

The original OWASP Cornucopia was primarily comprised of word-processing documents. Due to the efforts in recent years by many generous volunteers and organisations to codify OWASP Cornucopia, DBD Cornucopia's threat data has been added to its repository. This means that, because of the project's integrated gaming engine Copi, the deck is now available for teams to play digitally online.

Printing

Colin Watson had a small number of DBD Cornucopia decks printed to distribute to UK government departments, charities which campaign in this area, and academics undertaking research in the disciplines of service design and human-computer interaction. The first professionally printed OWASP Cornucopia deck in 2013 was distributed in a box which resembled a pack of cigarettes labelled with health warnings. Acknowledging that idea and the domestic nature of the harms, the physical DBD Cornucopia box is presented in the style of a powdered laundry detergent package, based on the notion that reducing harms is, in some way, cleaning up the e-government service. Sometimes humour is also necessary to counteract harms, and fun can help awareness and encourage use of service-user-oriented threat modelling.

The high-res design files are all available for download and print at www.digitalbenefits.uk/cornucopia.

NB: DBD Cornucopia is not an OWASP project.

Yes! It’s time to party! Again!! You may ask, but this time we have combined the strength of the OWASP Foundation’s open-source projects. 25 years of accumulated knowledge and wisdom distilled onto 158 playing cards.

Johan Sydseter — Mon, 11 May 2026 08:18:14 +0000

Johan Sydseter for OWASP® Foundation

May 11

Introducing a OWASP Game for threat modeling Agentic AI, Cloud, Devops, Frontend, LLM, Automation, and Web

#ai #security #gamedev #appsec

10 min read

Introducing a OWASP Game for threat modeling Agentic AI, Cloud, Devops, Frontend, LLM, Automation, and Web

Johan Sydseter — Mon, 11 May 2026 01:27:15 +0000

Shift-left doesn't start with scanning the code for security vulnerabilities; it begins with designing for security.

Too often, the shift-left mantra consists of implementing (AI-powered) code scanning and applying AI-powered security fixes for remediation. Also, don't forget to implement the AI-powered benchmark for AI-powered Security Fixes. Now, to be clear, I am not actually telling you to stop using these tools — if they work for you — instead, we should ask ourselves:

What are we working on?
What can go wrong?
What are we going to do about it?
Did we do a good job?

OWASP Cornucopia v3.0

In order to support that second question in particular, we have released the next version of OWASP Cornucopia v3.0.
If you would like to buy a professional physical copy of v3.0, you can do so at CyberSec Games. We would suggest buying the 25th anniversary edition as it also comes with both the Website App Edition 3.0 and the new OWASP Cornucopia Companion Edition, specifically made to be used together as an expansion. You can also download the design files from the release and take them to your local printer or print them yourself.

OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams in identifying security requirements in Agile, conventional, and formal development processes. It is language, platform, and technology-agnostic.
The formerly titled “Cornucopia — Ecommerce Website Edition” was renamed in v2.0 to “Cornucopia — Website App Edition”. This edition was originally created in August 2012, released as v1.0 in February 2013, and has undergone several minor updates/releases over the following ten to fifteen years. This has been substantially updated in v2.0, in which the most noticeable change was an update of the OWASP ASVS mapping from ASVS v3.0 to v4.0, together with the creation of translations into six languages (EN, ES, FR, NL, NO-NB, and PT-BR) due to the efforts of past and current volunteers.

The new version, available in 11 languages (EN, ES, FR, HI, NL, NO-NB, PT-PT, PT-BR, RU, UK, IT), includes all new cards and text that cover all OWASP ASVS 5.0 requirements and links them to more than 200 unique common attack patterns (CAPEC™). Each of the common attack patterns will have a unique set of ASVS 5.0 requirements, which means that you never need to stop playing the game! You will always be able to return to the same card to discover new threats and security requirements to consider when building your software; that's the Cornucopia way.

We have also created an API where you can find, programmatically, all requirements connected to each card together with a complete mapping between CAPECs and ASVS 5.0 requirements so that you can automate your threat modeling and requirement analysis processes. If you want to know more about the latest additions to the Website App Edition v3.0, read all about it on our blog post "The Cornucopia of Gamified Threat Modeling"

OWASP Cornucopia Companion Edition v1.0

Today, we are publishing a brand new OWASP Cornucopia Edition to complement the existing two editions. The OWASP Cornucopia Companion Edition v1.0 comes with 6 companion suits covering new topics: Agentic AI (AAI), Automated Threats (BOT), Cloud (CLD), Frontend (FRE), Large Language Models (LLM), and DevOps (DVO). A suit in the companion deck may replace (or be used in addition to) suits in the existing Website Edition so that the players can add a specific focus to their threat modeling: For example, say you are building an LLM application and want to perform threat modeling and security requirement analysis specifically for LLM. You would then use the OWASP Cornucopia Website Edition and the LLM companion suit as your elected OWASP Cornucopia focus area. The new version is immediately available online at copi.owasp.org and for sale at CyberSec Games. You can also download the design files from the latest release.

To commemorate the OWASP Foundation's 25th anniversary, we have also designed the case, leaflet, and cards specifically to celebrate the anniversary and OWASP's achievements within the field of application security and software engineering. We will also be attending the OWASP Global AppSec 2026 in Vienna, where we will be demoing the game for anyone who wants to come and play with us.

We feel this is only the start; each year, OWASP Cornucopia resellers distribute 1,000 games to teams worldwide. At copi.owasp.org, more than 500 users conduct threat modeling for mobile applications, agentic AI, automated threats, cloud, identity management, large language models, and SDL processes every month. In the coming time, we at OWASP Cornucopia will work towards promoting threat modeling and games to change the security culture at software companies worldwide.

Why a companion edition?

The time when development teams could focus only on web development is long gone. Modern software development and sprint planning often include implementing integrations towards large language models, AI agents, and DevOps pipelines through full-stack development. In such an environment, security requirements are constantly shifting from sprint to sprint. Therefore, the only possibility is choosing an agile and collaborative approach to threat modeling that supports including a large number of people with various backgrounds, experiences, and knowledge.
The OWASP Cornucopia Companion Edition was created to accommodate this. A big, beautiful Excel document can never replace a collaborative approach to threat modeling that includes the opinions of everyone on the development team. To avoid having the threat modeling and security design processes become an exercise in superficial ISO compliance, you need to empower your development teams to work together to come up with a secure design. Such a process requires ingenuity, to think out of the box, and to make unpopular decisions that may affect the delivery schedule of a development project. Neither an Excel document nor an ISO 27001 policy will ever get a development team to do that.

Failing to regularly assess your security isn't only costly; it can leave you vulnerable to threats. Several companies have implemented OWASP Cornucopia as part of their SDLC and use it for security requirements analysis, threat modeling, and secure design for every sprint and every user story. You should do the same! Don't let your business spiral out of control; consciously assess how you are doing by continuously threat-modeling your applications and infrastructure. To get started scaling your threat modeling efforts, OWASP Cornucopia and its companion edition are the perfect tools.

We want to thank all project leaders and contributors to the OWASP projects who have provided valuable input and guidance on the OWASP Top 10, OWASP AISVS, OWASP MAS, OWASP Cumulus, OWASP Threat Dragon and the OWASP GenAI Security project. It's thanks to these projects, and many more, that we can deliver to you the OWASP gamified approach to threat modeling and requirement analysis.
We also want to thank the people and contributors to Mitre's Common Attack Pattern Enumeration and Classification (CAPEC™) and Atlas, together with CSA Cloud Controls Matrix, which are all used in the cross-references provided.

Walk that walk, talk that talk

With this latest version of OWASP Cornucopia, we are making it more than a game; it has become a fully fledged threat modeling tool. It doesn’t just feed into your threat modeling process; it drives it, and it doesn’t just work; it scales! A long-time project contributor, previously working at Banco de Crédito BCP, used OWASP Cornucopia to train hundreds of people in using OWASP Cornucopia for threat modeling.
Several companies, such as Admincontrol AS, a Euronext subsidiary, are using it as part of their custom development methodology and have made it the primary mechanism for structured threat elicitation.

"Continuous Gamified threat modeling", done the OWASP way, has been tested and proven to work and is generally welcomed by ISO auditors. Not only is it welcomed, but auditors also love to hear about how it can be used to create engagement and change the culture of the companies that make use of it. This, according to Admincontrol, which has been audited 4 times using all 97 controls from ISO 27001/27002 as part of their information security management system. "Continuous Gamified Threat Modeling" is about assisting software development teams in identifying security requirements in Agile, conventional, and formal development processes through continuous gamification and threat modeling for every feature and every release. Don't apologize for designing before coding, it's called thinking!

And the developers? They love it! At the company I work for (Admincontrol), they always send out an anonymous survey to gather team feedback.
The aggregate score for how satisfied respondents have been with all sessions they've held since they started to use OWASP Cornucopia in 2023 is 4.5 out of 5, which is the maximum. When asked how relevant the session was to the participant's job, the average score was 4.7 out of 5.

The point here is not just to do your initial security risk assessment and be done with it, but to continuously look for new threats as you improve your software, in line with the Threat Modeling Manifesto.

"Continuous Threat Modeling", a term described in "Threat Modeling: A Practical Guide for Development Teams", is essential to keep your applications and infrastructure secure as you expand your system with new features and machines and increase the attack surface. Gamification can help you get started doing just that. So why would you want to continuously threat model your infrastructure and applications? Isn't it enough to just do a thorough check-up now and then? Admincontrol thought so as well!

Admincontrol used threat modeling to design its applications. They have large sessions that they run once a year and several smaller sessions for each sprint. They define Jira issues to mitigate these threats and assign them directly to the development team's backlog. Then they have security backlog grooming once a month with the product owners, where they discuss directly with them how they can resolve these issues.
The first graph shows the resolution time for Jira issues created during the annual threat modeling session. The second graph shows the resolution of Jira issues for the threat modeling they do each sprint.

As shown in the first graph, the resolution time is increasing. This is because they had Jira issues that were defined but never resolved. Some of the issues had taken nearly 3 years to resolve.
The second graph shows an increase in resolution time. This is because Admincontrol had a component that didn't get finalized. It stayed on the drawing board, but the threat modeling was done, so the resolution time spiked. There are no data prior to 2023, as they didn't keep this form of statistics before then. On average, the resolution time for the short threat modeling sessions were ca. 3 months. This usually coincided with the frequency of their minor releases, which included new features.

If you do long, large sessions, you run the risk of doing threat modeling irregularly, meaning you will have issues you will never be able to solve, and issues meant to improve security will stay in the development team's backlog forever, never to see the light of day. If you think technical debt is scary, wait until you see your security debt.

Credits

We want to thank everyone who has made this possible. Especially, we want to thank

Adrian Sroka, for bringing us the Agentic AI, Cloud, and Frontend suits for the new game and creating online pages and mapping his threats to OWASP AISVS, AITG, Top 10 Agentic Apps, and Top 10 for LLM, Mitre Atlas, and STRIDE.

Mateusz Hubala, for bringing us the DevOps suit for the game and creating online pages and mapping his threats to OWASP SAMM and DSOMM, CAPEC, and STRIDE.

Moritz Krause & Torben Neumann, for bringing us the LLM suit for the game and mapping their threats to OWASP AISVS, AITG, Top 10 for LLM, Mitre Atlas, CWE, and STRIDE.

Colin Watson for bringing us the Automated Threats suits and mapping his threats to OWASP Automated Threats to Web Applications.

We also want to especially thank Ayman Algamal, Adarsh Kumar, Abhijit Sahoo, and Mradul Tiwari for helping develop the game, now available at copi.owasp.org, and for creating the help pages at cornucopia.owasp.org.

And we want to thank all project leaders and contributors to the OWASP projects that have provided valuable input and guidance on the OWASP Top 10, OWASP AISVS, and the OWASP GenAI Security project. We also want to thank the people and contributors to Mitre's Common Attack Pattern Enumeration and Classification (CAPEC™) and Mitre Atlas™, and the Cloud Security Alliance for the use of the Cloud Controls Matrix, which are all used in the cross-references provided.

In addition, we want to thank Anand kushwaha, Mahaboobunnisa Md for helping with the release of v3.0.0 and CyberSec Games for all the help and support with the printing and distribution of the 25th anniversary edition.

Final words

OWASP is a non-profit foundation that envisions a world with no more insecure software. Our mission is to be the global open community that powers secure software through education, tools, and collaboration. We maintain hundreds of open source projects, run industry-leading educational and training conferences, and meet through over 340 chapters worldwide.

The Cornucopia of Gamified Threat Modeling

Johan Sydseter — Tue, 24 Mar 2026 09:55:15 +0000

At the OWASP Cornucopia project, we are done with updating the cards and help pages for the Website App Edition v3.0: https://cornucopia.owasp.org/edition/webapp/VE2/3.0

We would like to thank everyone who contributed to the translations for the new version of the card game and welcome you to review the text on the help pages themselves. Are there inconsistencies? Is there something you feel should be added or removed? If you find anything, please don't hesitate to contact us or raise an issue. Each page includes a "View source on GitHub" button that lets you quickly edit the text if you aren't pleased with it. All viewpoints and critiques are welcome as we are trying to create a home for gamified threat modelling.

The new Website App Edition v3.0, available in 11 languages (EN, ES, FR, HI, NL, NO-NB, PT-PT, PT-BR, RU, UK, HI), connects 202 CAPECs individually to a set of ASVS 5.0 requirements in relation to each of the cards. This means, even though you only have 80 cards, the website describes an exponential number of possible threats, making it the Cornucopia of website app threats. There is simply no end to the possibilities that your thoughts can take you while playing the game, yes, that's the Cornucopia way.
But what if you want to focus on a specific CAPEC and find the related OWASP ASVS requirements?
Go to a card, click on the CAPEC in the CAPEC map, and it will give you all the possible OWASP ASVS combinations, thereby connecting attack patterns and security requirements, making a thorough and deep website security requirement analysis possible while discussing a specific card. You can literally spend weeks analysing, playing, deciding for yourself "What can go wrong?", "What to do about it?", and even form yourself an opinion on whether you really did a good job (see: Shostack's Four Question Frame for Threat Modeling).

Have we stopped there? Now we haven't! For each card, you also have the "OWASP Cheat Sheet Series Index". What is that? The "OWASP Cheat Sheet Series Index" is an OWASP index that connects each of the ASVS requirements with a set of OWASP Cheat Sheets that will give you advice on how to implement the specific OWASP ASVS requirement! Want to know how to do log protection according to "OWASP ASVS V16.4 - Log Protection"? No problem! The "OWASP ASVS (5.0) Cheat Sheet Series Index" displayed on the help pages for each card will take you to the collection of OWASP Cheat Sheets that is related to the requirement you are wondering about.

But there is even more! What about STRIDE? What about Threat Modeling? Each card has a STRIDE section, a "What can go wrong?" section and a "What are we going to do about it?" section.

This means that during your threat modeling, if you have questions about "What can go wrong?" or "What are we going to do about it?" Just go to the individual card pages, and you will find what you are looking for!

Now, you may be asking yourself, "That's it, right? No, it isn't, we have even moooooooore!

Threat Dragon and EoP Games

When choosing a tool for publishing our threat model, we chose OWASP Threat Dragon. OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application. It is used to create threat modeling diagrams and list threats for elements within the diagrams. Mike Goodwin created Threat Dragon as an open-source community project that provides an intuitive, accessible way to model threats.

OWASP Threat Dragon has released this possibility in v2.6. This is just the start of integration between the two projects.

Thanks to Gerardo Canedo and his students at Universidad Católica del Uruguay, it's now possible to create your OWASP Cornucopia Threat Model directly in OWASP Threat Dragon. When creating a new diagram for your threat model, simply choose to create an EoP Games diagram. We chose to call the diagram EoP Games for two reasons. One, OWASP Cornucopia is derived from the Elevation of Privilege game created by Adam Shostack. Two, we don't want to stop with OWASP Cornucopia. We also want to add other EoP games, such as the original EoP Game.

Once you have created an EoP Games diagram, you can add OWASP Cornucopia threats to your threat model. The specific threat you add will get a link reference to the OWASP Cornucopia website, where you will find guidance on threat modeling and STRIDE, which will help you in identifying what can go wrong and what to do about it. You can also find a complete mapping to OWASP ASVS, OWASP Developer Guide, and all relevant CAPECs.

I want to express my sincere appreciation to Gerardo Canedo, Sebastian Feirres, and their students at Universidad Católica del Uruguay for making this possible. With their dedication and effort, OWASP Cornucopia wouldn’t have had this possibility.

Shostack's 4 Question Frame for Threat Modeling

OWASP Cornucopia, together with OWASP Threat Dragon, is helping us in answering:

What we are working on
What can go wrong?
What are we going to do about it?

...but "Did we do a good enough job?"

At Admincontrol, where I work, we have always sent an anonymous survey after every OWASP Cornucopia threat modeling session. The aggregate score for how satisfied respondents have been with all sessions we've held since we started OWASP Cornucopia in 2023 is 4.5 out of 5. When asked how relevant the session was to the participant's job, the average score was 4.7 out of 5. When asked whether the OWASP Cornucopia session helped the participants understand which security controls (mitigations) they need to implement/test, the score was 4.5. When asked whether the session improved the overall awareness of application security requirements, the score was 4.0. When asked, "Did we do a good job?", the score was 4.3. So for sure, we can do better!

When asking the question, "Did we do a good enough job?", don’t just blurt it out during a session. Do you honestly think people will give you their honest criticism to your face directly? Send out an anonymous survey and ask for feedback!

How to get those requirements into your issue tracking software

So you have done your threat modeling and security requirement analysis, what comes next? You need to create an issue that the development team can work on, and you need to add it to the development team's sprint. How do you do it?
The OWASP Cornucopia project is creating a requirements API that lets you harvest the security requirements you want. After you have created your threat model in OWASP Threat Dragon, extract its JSON response, look up the threats you have identified, and find the corresponding security requirements by using the API, merge the results together, and generate your evil user stories by pushing the results to your issue tracking software just in time for the development team's next sprint.

How to get OWASP Cornucopia?

The question you might be asking yourself is, "How are we going to be able to utilize these resources and play this game?" No problem! There are various ways you can do that, both online at copi.owasp.org and in person, enjoying the presence of your colleagues, by buying a deck of cards.

What is coming next...

But what about DevOps? What about LLM and AI Agents? We are working on that too. The new OWASP Cornucopia Companion Edition, that soon will be published, can be used alongside the OWASP Website App Edition and it comes with 6 new companion suits covering new topics: Agentic AI (AAI), Automated Threats (BOT), Cloud (CLD), Frontend (FRE), Large Language Models (LLM), and DevOps (DVO). A suit in the companion deck may replace (or be used in addition to) suites in the existing Website Edition so that the players can add a specific focus to their threat modeling: For example, say you are building an LLM application and want to perform threat modeling specifically for LLM. You would then use the OWASP Cornucopia Website Edition and the LLM companion suite as your elected OWASP Cornucopia focus area.

OWASP is a non-profit foundation that envisions a world with no more insecure software. Our mission is to be the global open community that powers secure software through education, tools, and collaboration. We maintain hundreds of open source projects, run industry-leading educational and training conferences, and meet through over 250 chapters worldwide.

OWASP Cornucopia is publishing it’s darkest secrets!

Johan Sydseter — Mon, 16 Feb 2026 06:39:00 +0000

Why do we keep our darkest fears secret? Publish them, and bring light to the darkest corners of your web application.

When Adam Schostack + associates last year urged everyone to publish their threat model, we thought, «What a wonderful idea!»

So we went ahead and did just that. At cornucopia.owasp.org, you can now find the threat model for the OWASP Cornucopia Game Engine, Copi.
There we have listed all our darkest fears and secrets. Darkness is not a force of its own; it is simply the absence of light. When light is shed on our doubts and fears, making them visible, we find solutions and become stronger. This is why publishing your threat model is essential. If you refuse to disclose your vulnerabilities to anyone, they become liabilities that may one day lead to doubts, lies, and perhaps even conspiracies and litigation. Therefore, before building software, build trust and make it clear what others need to be aware of.

Threat Dragon and EoP Games

OWASP Threat Dragon will release this possibility in v2.6, which is due to be released in week 9, but already now, you can try it out on their demo site. This is just the start of integration between the two projects; more is to come. OWASP Threat Dragon V2.6 will come out with all sorts of exciting features. For a full list, have a look at their current v2.6 roadmap.

Once you have created an EoP Games diagram, you can add OWASP Cornucopia threats to your threat model. The specific threat you add will get a link reference to the OWASP Cornucopia website, where you will find guidance on threat modeling and STRIDE, which will help you in identifying what can go wrong and what to do about it. You can also find a complete mapping to OWASP ASVS, OWASP Developer Guide, and all relevant CAPECs.

Shostack's 4 Question Frame for Threat Modeling

OWASP Cornucopia, together with OWASP Threat Dragon, is helping us in answering:

What we are working on
What can go wrong?
What are we going to do about it?

...but "Did we do a good enough job?"

OWASP Cornucopia welcomes any input or improvements you might be willing to share with us regarding our current threat model. Arguably, we created the system before we were able to identify all our threats, and several improvements need to be made to properly balance the inherent risks of compromise against the current security controls. For anyone hosting the game engine, please take this into account. For anyone wanting to share their opinion, please don't hesitate to visit our repository, share your feedback, and, if appropriate, give us a star⭐️.

OWASP is a non-profit foundation that envisions a world with no more insecure software. Our mission is to be the global open community that powers secure software through education, tools, and collaboration. We maintain hundreds of open source projects, run industry-leading educational and training conferences, and meet through over 250 chapters worldwide.

Are you the next card game designer for OWASP Cornucopia Website Edition v3.0? Then get in touch with us for fame and glory!

Johan Sydseter — Thu, 13 Nov 2025 14:38:16 +0000

Johan Sydseter for OWASP® Foundation

Nov 13 '25

OWASP Cornucopia 3.0 - A call for card game designers!

#gamedev #security #design #webdev

2 min read

OWASP Cornucopia 3.0 - A call for card game designers!

Johan Sydseter — Thu, 13 Nov 2025 12:24:59 +0000

Would you like to be our card game designer for the OWASP Cornucopia Website Edition v3.0?

We are close to releasing the next version of OWASP Cornucopia Website Edition v3.0

We wonder whether there are some brilliant designers out there who would like to volunteer to create the motifs for the 80 cards in OWASP's very popular threat modeling card games for website applications?

OWASP® Cornucopia is a threat modeling tool in the form of a card game to assist software development teams in identifying security requirements in Agile, conventional, and formal development processes. It strives to be language, platform, and technology-agnostic.

It’s one of the few tools that connects threat modeling with OWASP ASVS, SAFECode, STRIDE, OWASP DevGuide, and CAPEC, helping to identify security requirements, develop a secure design, and create a threat model without prior knowledge of these frameworks.

We are now creating the next version of the website app game. The new version will feature new cards and text that cover all of the requirements in OWASP ASVS 5.0 and connect these to more than 210 unique common attack patterns (CAPEC).

The first edition was created in August 2012, released as v1.0 in February 2013, and has undergone several minor updates/releases over the subsequent ten years. This has been substantially updated in today’s release of v3.0, with the most noticeable change being the update of the OWASP ASVS mapping from ASVS v4.0 to v5.0. The card game comes in two physical sizes. The smaller ones are often referred to as “bridge-sized cards” and the larger ones as “Tarot-sized cards”. All these v3.0 files will be immediately available in nine languages (English, Spanish, French, Dutch, Norwegian, Portuguese, Italian, Russian, and Hungarian) due to the efforts of past and current volunteers.

Don't hesitate to get in touch with us for fame and glory.

Uncover the security flaws in your software's design before the bad guys do it for you! Get your team together on a call or in a room and use OWASP Cornucopia Web & Mobile, Elevation of Privilege or Elevation of MLSec and OWASP Cumulus to secure your AI models and Cloud infrastructure respectively and guide your threat modelling at copi.owasp.org, and if you visit our code repository please give us a star ⭐️.

OWASP is a non-profit foundation that envisions a world with no more insecure software. Our mission is to be the global open community that powers secure software through education, tools, and collaboration. We maintain hundreds of open source projects, run industry-leading educational and training conferences, and meet through over 250 chapters worldwide.

[Boost]

Johan Sydseter — Wed, 08 Oct 2025 20:02:20 +0000

Johan Sydseter for OWASP® Foundation

Oct 3 '25

How do you get your dev team to shift left by themselves for real?

#devops #security #ai #gamedev

6 min read